Opera/Netscape/Mozilla: Floppy access from untrusted java applet

[Marc Schoenefeld <schonef () uni-muenster de>]

Hi,

just put the floppy reading java call in an applet for those who think
the problem has nothing to do with java. The problem is that
the sandbox should protect the system from untrusted access
to system ressources, such as a floppy drive. But again
like many things in the jdk (see illegalaccess.org for details)
this does not work like printed in the java specification.

You can try the new floppy applet at:
http://www.illegalaccess.org/exploits/java/applet/MyFloppySucks.html

Tested on:
-  IE 6
-  Opera 7.2
-  Netscape

on Win32...

Warning: The applet may start an alert message to enter a floppy
disk, if this [your own!] disk is infected by a virus, it may damage
your PeeCee. But the applet itself is plain java, no
disk virus included !

Marc

--

Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous

Marc Schönefeld Dipl. Wirtsch.-Inf. / Software Developer

---------- Forwarded message ----------
Date: Wed, 8 Oct 2003 00:08:33 +0200 (MES)
From: Marc Schoenefeld <schonef () uni-muenster de>
To: full-disclosure () lists netsys com
Subject: Opera/Netscape/Mozilla: Floppy access from liveconnect html page
    (fwd)


Hi,

just tried the following html page in opera 72/netscape 72/mozilla
on windows and I was prompted with an insert floppy prompt box.
The page was uploaded to a remote site and loaded from there.

(script)
a=Packages.org.apache.crimson.tree.XmlDocument.createXmlDocument("file:///a:/");
(/script)

Can anybody try this please to verify the issue ? Instead of a:
you could also please try com1/lpt1/prn/aux/clock$.

My used java version is jdk 1.4.2_01 browser plugin.

Thanks Marc

--

Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous

Marc Schönefeld Dipl. Wirtsch.-Inf. / Software Developer
[ PGP Signature ok - Wed Oct  8 00:07:59 MES 2003 ]


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html